The vulnerability identified as CVE-2026-40185 affects mauriceboe TREK versions before 2.7.2. It is classified as CWE-862, indicating missing authorization checks. Specifically, the Immich trip photo management routes did not enforce proper authorization, allowing users with limited privileges (PR:L) to perform actions without appropriate permissions. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) reflects network attack vector, low attack complexity, privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The vulnerability is resolved in version 2.7.2.

The vulnerability allows unauthorized access to trip photo management functions, potentially exposing sensitive photo data (high confidentiality impact). Integrity impact is low, meaning some unauthorized modifications might be possible but are limited. There is no impact on availability. No known active exploitation has been reported.

Upgrade mauriceboe TREK to version 2.7.2 or later, where the missing authorization checks on the Immich trip photo management routes have been fixed. Since this is an application-level vulnerability, applying the official update is the primary remediation. Patch status is confirmed by the vendor's versioning note. No additional mitigations or temporary fixes are documented.